Privacy & data
What we store
Account email, password hashes, API key digests, balance movements, model/token usage and top-up orders. Historical orders from retired payment channels and voluntarily submitted payment references may be retained for reconciliation and disputes. Before verification, pending email addresses, password hashes, verification-code digests, expiry and attempt counts are stored temporarily and removed after successful verification or expiry cleanup. Full verification codes are not stored in the database. New API keys are temporarily encrypted for a single claim. After a successful claim, the server destroys that ciphertext and retains only a non-reversible authentication digest; the full key cannot be recovered.
How payment information is handled
Stripe Checkout is integrated on our server. Stripe's hosted pages process payment credentials, device/risk information and transaction data under Stripe's policies. We retain Stripe object IDs, amounts, currencies, statuses and audit timestamps needed for order linking, signed-webhook idempotency, disputes and reconciliation. We do not collect raw card numbers, wallet passwords or verification codes. Necessary records from retired payment channels are retained only for reconciliation, disputes and compliance audits.
Verification email delivery
Six-digit codes are sent through the operator's configured SMTP service. The email provider processes recipient addresses, sender details and message contents to deliver the email. Codes are only for creating an account here, not third-party registration. We never request third-party passwords, codes or cookies.
How model requests are handled
Prompts, file contents and model outputs are transmitted in real time to third-party model providers. For troubleshooting, abuse handling, billing disputes and authorized maintenance, request bodies that enter the model pipeline are retained for 7 days after structured credential fields are redacted. Access is restricted to administrators and logged. Up to 256 KiB is retained per request; larger requests keep only a redacted preview and original size. Model output bodies are not stored in our audit database. Model providers, reverse proxies and hosting logs may process data under their own policies. Do not submit unnecessary sensitive information.
Purpose and security
Data is used for authentication, billing, reconciliation, refund/dispute handling, support and abuse prevention. Safeguards include password hashes, key digests, destruction of temporary ciphertext, HTTPS deployment requirements and access controls. Claimed keys exist only in the current page's memory and wherever you choose to save them; we cannot recover them after a refresh. No networked system can guarantee absolute security.
Access, correction and deletion
To access, correct or request deletion of your account data, contact: [email protected]. Records required for billing, risk controls, refunds/disputes or statutory retention may not be deleted immediately. Operator: FengyuToken; business / registered address: 36 Jalan Rumah Tinggi, Singapore 150036, SG.